SOA-C03 practice question 4 of 10

Application A runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are in an Auto Scaling group and are in the same…

Domain Networking and Content Delivery

Application A runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are in an Auto Scaling group and are in the same subnet that is associated with the NLB. Other applications from an on-premises environment cannot communicate with Application A on port 8080. To troubleshoot the issue, a CloudOps engineer analyzes the flow logs. The flow logs include the following records: ACCEPT from 192.168.0.13:59003 → 172.31.16.139:8080 REJECT from 172.31.16.139:8080 → 192.168.0.13:59003 What is the reason for the rejected traffic?

Answer options

A: The security group of the EC2 instances has no Allow rule for the traffic from the NLB.

B: The security group of the NLB has no Allow rule for the traffic from the on-premises environment.

C: The ACL of the on-premises environment does not allow traffic to the AWS environment.

D: The network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range. Correct answer

Correct Answer:

D. The network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range.

Explanation

The VPC Flow Logs provide critical information. The ACCEPT record for inbound traffic (192.168.0.13 → 172.31.16.139:8080) confirms that both the Network ACL (NACL) and the EC2 instance's security group are correctly configured to allow the initial request. However, the REJECT record for the return traffic (172.31.16.139:8080 → 192.168.0.13:59003) indicates the response is being blocked. Security groups are stateful, meaning if inbound traffic is allowed, the return traffic is automatically permitted. In contrast, NACLs are stateless and require explicit rules for both inbound and outbound traffic. The rejection of the response packet, destined for the client's ephemeral port (59003), points directly to a missing or incorrect outbound rule in the NACL associated with the instance's subnet.

Why Incorrect

A. The inbound traffic is ACCEPTed, which would not be possible if the security group were blocking traffic from the NLB's targets.
B. Network Load Balancers do not have security groups. Security groups are associated with the target EC2 instances, not the NLB itself.
C. The initial traffic from the on-premises environment was ACCEPTed by the AWS VPC, indicating the on-premises ACL is not the source of the block.

References

1. AWS Documentation - VPC Flow Logs: "If the traffic is permitted by both the security groups and the network ACLs, the record shows ACCEPT. If the traffic is denied by a security group or a network ACL, the record shows REJECT." (Source: AWS Documentation, VPC User Guide, "Log file format", section on the action field).

2. AWS Documentation - Network ACLs: "Network ACLs are stateless, which means that responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa)." (Source: AWS Documentation, VPC User Guide, "Network ACLs", section "Network ACL basics").

3. AWS Documentation - Ephemeral Ports: "When a client connects to a server, a random port from the ephemeral port range... becomes the client's source port. The response from the server is sent to this ephemeral port on the client... The network ACL for the subnet... must have an outbound rule to allow traffic destined for the ephemeral ports." (Source: AWS Documentation, VPC User Guide, "Network ACLs", section "Ephemeral ports").

4. AWS Documentation - Security Groups: "Security groups are stateful. If you send a request from your instance, the response traffic for that request is allowed to flow in, regardless of inbound security group rules." (Source: AWS Documentation, VPC User Guide, "Security groups", section "Security group basics").

Question breakdown

Tests: Troubleshoot VPC connectivity using flow logs, security groups, and network ACLs
Difficulty: Medium

Key idea: Network ACLs are stateless, so return traffic to client ephemeral ports needs an explicit outbound rule, while security groups allow return traffic automatically.

How to reach the answer

The inbound request to port 8080 shows ACCEPT, so the inbound filtering works.
The response from port 8080 to client port 59003 shows REJECT.
Security groups are stateful, so the response to an accepted request cannot be rejected by a security group.
Only a stateless control can block the return path, which means the subnet's network ACL.
The NACL needs an outbound rule allowing the ephemeral port range (1024-65535) to the on-premises CIDR.

Each option

AIncorrect. The inbound flow was accepted, so the instance security group already allows the traffic, and its stateful nature permits the reply.
BIncorrect. Whatever the NLB security group configuration, the inbound request reached the instance and was accepted, so the failure is on the return path.
CIncorrect. The flow logs record a reject inside the VPC on the outbound response, not a block in the on-premises network.
DCorrect. A stateless NACL without an outbound allow for ephemeral ports drops the response to port 59003, which matches the REJECT record.

Common trap: People see REJECT and blame a security group, forgetting that stateful security groups automatically allow replies to accepted requests.

In practice: Teams that tighten NACLs to specific service ports often break return traffic until they add outbound ephemeral port rules, and flow logs reveal it as an ACCEPT-in, REJECT-out pair.

Remember: An ACCEPT inbound followed by a REJECT on the reply points to a stateless NACL missing an ephemeral-port rule.

Official documentation: Control subnet traffic with network access control lists · Logging IP traffic using VPC Flow Logs

Reviewed by David Mercer.

Keep practicing

Take the free SOA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test